CVE-2026-64554

CVE CVE-2026-64554EUVD EUVD-2026-49605Published 2026-07-27T20:10:41.000ZLast changed 2026-08-05T12:42:59.000ZCVSS 8.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_head(), leaving prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a use-after-free write. Save prevhdr's offset before skb_checksum_help() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment"). BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) Write of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip6_frag_next (net/ipv6/ip6_output.c:857) br_ip6_fragment (net/ipv6/netfilter.c:212) nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407) nf_hook_slow (net/netfilter/core.c:619) br_forward_finish (net/bridge/br_forward.c:66) __br_forward (net/bridge/br_forward.c:115) maybe_deliver (net/bridge/br_forward.c:191) br_flood (net/bridge/br_forward.c:245) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:442) ... packet_sendmsg (net/packet/af_packet.c:3114) ... do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 764dd163ac922f8683b5bcd3007251ce7b26cd33 <8c10778ec674b67a07ea042fcba64270f3f38a5a; patch: 5.10.261; patch: 6.12.97; patch: 5.15.212; 764dd163ac922f8683b5bcd3007251ce7b26cd33 <f2e6596d10783557aeb9668da2a3b4d19deb2001; patch: 0; 764dd163ac922f8683b5bcd3007251ce7b26cd33 <2731efa6364e47934c96eb69e01ea131e8af8030; 764dd163ac922f8683b5bcd3007251ce7b26cd33 <4ac981a8b7ce7aec99a52d08f8a8953e8e120067; patch: 6.18.40; patch: 7.1.5; 764dd163ac922f8683b5bcd3007251ce7b26cd33 <00c06ef8c018493943891a7d0ca82b71b24f3180; patch: 6.1.178; 764dd163ac922f8683b5bcd3007251ce7b26cd33 <c141f69d0a0fb16964dbc293650047e69bda8af7; patch: 7.2-rc4; patch: 6.6.145; 5.3; 764dd163ac922f8683b5bcd3007251ce7b26cd33 <86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d; 764dd163ac922f8683b5bcd3007251ce7b26cd33 <1c4f67c89fd27c4df4c70b135c2c59627698b3c0

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.